{"id":"CVE-2026-119733","title":"Munshi Missing Authorization in Company Deletion API","summary":"Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Petpooja","product":"Munshi","affected":["Munshi <= 2026-07-07"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T19:50:25.130692Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T19:50:35.888Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119733","references":[{"url":"https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c","label":"Researcher Disclosure"},{"url":"https://www.petpooja.com/","label":"Vender Homepage"},{"url":"https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api","label":"VulnCheck Advisory: Munshi Missing Authorization in Company Deletion API"}],"tags":["cve.org","exploit-available"],"epss":0.00331,"epssPercentile":0.26377,"ingestedAt":"2026-11-05T19:30:42.814Z","slug":"CVE-2026-119733","body":"## Overview\n\nMunshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.\n\n## Affected\n\n- `Munshi <= 2026-07-07`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}